`571-272-7822
`
`
`
`
`
` Paper 12
` Entered: July 20, 2017
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`____________
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`____________
`
`WESTINGHOUSE AIR BRAKE TECHNOLOGIES CORPORATION
`(d/b/a WABTEC CORPORATION),
`Petitioner,
`
`v.
`
`SIEMENS INDUSTRY, INC.,
`Patent Owner.
`____________
`
`Case IPR2017-00584
`Patent 8,714,494 B2
`____________
`
`
`Before KRISTEN L. DROESCH, MEREDITH C. PETRAVICK, and
`TIMOTHY J. GOODSON, Administrative Patent Judges.
`
`DROESCH, Administrative Patent Judge.
`
`DECISION
`Denying Institution of Inter Partes Review
`35 U.S.C. § 314, 37 C.F.R. § 42.108
`
`
`
`
`
`
`
`
`
`
`
`IPR2017-00584
`Patent 8,714,494 B2
`
`I. INTRODUCTION
`A. Background
`Westinghouse Air Brake Technologies Corporation (d/b/a Wabtec)
`
`(“Petitioner”) filed a Petition (Paper 2, “Pet.”) for inter partes review of
`claims 1, 2, 5, 10, 11, 14, 17, and 18 (“the challenged claims”) of U.S.
`Patent No. 8,714,494 B2 (“the ’494 Patent”). See 35 U.S.C. §§ 311–312.
`Siemens Industry, Inc. (“Patent Owner”) timely filed a Preliminary
`Response (Paper 10, “Prelim. Resp.”).
`
`We have authority under 35 U.S.C. § 314 and 37 C.F.R. § 42.4. An
`inter partes review may not be instituted unless it is determined that “the
`information presented in the petition filed under section 311 and any
`response filed under section 313 shows that there is a reasonable likelihood
`that the petitioner would prevail with respect to at least 1 of the claims
`challenged in the petition.” 35 U.S.C. § 314(a).
`
`After considering the Petition, for the reasons provided below, we
`determine, based on the record before us, there is not a reasonable likelihood
`Petitioner would prevail in showing claims 1, 2, 5, 10, 11, 14, 17, and 18 are
`unpatentable.
`
`
`B. Related Matters
`The parties indicate the ’494 Patent is asserted in Siemens Industry,
`
`Inc. v. Westinghouse Air Brake Technologies Corporation et al., Case No.
`1:16-cv-00284 (D. Del.). Pet. 15; Paper 4, 2; Paper 6, 2.
`Petitioner indicates two petitions for inter partes review were filed for
`
`related U.S. Patent No. 9,233,698, Case Nos. IPR2017-00580 and IPR2017-
`00581. Paper 4, 2; Paper 6, 2.
`
`
`
`2
`
`
`
`IPR2017-00584
`Patent 8,714,494 B2
`
`C. The ’494 Patent (Ex. 1001)
`The ’494 Patent discloses a railway vital application system and
`method that substitutes commercial off-the-shelf (COTS) hardware and/or
`software for railway-domain specific product components, yet validated to
`conform with railway vital system failure-free standards. Ex. 1001,
`Abstract, 2:46–52.
`Figure 4 of the ’494 Patent is reproduced below:
`
`
`Figure 4 depicts a schematic diagram of computer controllers for train
`vital system control systems. See Ex. 1001, 4:19–21. Vital system
`controllers VS1 and VS2 each comprise paired set of controllers C1 300 and
`C2 320 in bilateral communication with each other via intercontroller data
`bus 330. See id. at 7:11–14. Controller C1 300 is capable of bilateral
`communication with critical system data bus 92 through communications
`pathway 340. See id. at 7:34–36. Controller C1 300 has incoming security
`code verification module 240 enabled to verify data integrity of incoming
`3
`
`
`
`
`
`IPR2017-00584
`Patent 8,714,494 B2
`input vital systems message (VSMI). See id. at 7:38–40. VSMIs include
`critical input data (DI) and an input security code (SCI) generated by known
`check-sum, hash, etc., protocols. See id. at 6:51–62. Controller C1 300 does
`not have the capability to generate an output vital systems message (VSMO)
`output security code (SCO). See id. at 7:40–41. Controller C2 320 has an
`enabled SCO generator module 250, but is incapable of transmitting SCO
`and critical output data (DO) directly to critical system data bus 92. See id.
`at 7:42–45. Controller C2 320 is only capable of transmitting the SCO to
`controller C1 300 via intercontroller data bus 330. See id. at 7:45–46.
`Controller C2 320 is only capable of receiving VSMI through unilateral
`incoming communications pathway 350 and can verify data integrity with
`SCI verification module 240. See id. at 7:46–49.
`Figure 6 of the ’494 Patent is reproduced below:
`
`
`
`4
`
`
`
`
`
`IPR2017-00584
`Patent 8,714,494 B2
`Figure 6 depicts a timing diagram showing processing steps
`performed by the vital systems control system. See Ex. 1001, 4:22–27. In
`step 400 at time t1, one of vital systems VS2–VSn sends VSMI to VS1
`comprising DI and SCI to controllers C1 and C2. See id. at 7:61–63. In step
`410 at time t2, both C1 and C2 verify the VSMI data integrity, and in step
`415 C1 and C2 compare verification results. See id. at 7:63–64. In step 420
`at time t3, C1 and C2 both generate DO in response to DI. See id. at 7:63–
`65. In step 425, C1 and C2 compare DO. See id. at 8:15–17. In step 430 at
`time t4, C2 generates SCO, and in step 440, C2 sends SCO to C1. See id. at
`7:65–67. In step 450 at time t5, C1 assembles and optionally verifies DO
`provided by C2 with its own generated DO before transmitting VSMO
`through critical systems data bus 92 to other vital systems in step 460 at time
`t6. See id. at 7:67–8:4.
`
`D. Illustrative Claim
`Of the challenged claims, claims 1, 10, and 17 are independent, with
`
`claims 2 and 5 dependent from claim 1, claims 11 and 14 dependent from
`claim 10, and claim 18 dependent from claim 17. Claim 1 is illustrative and
`is reproduced below:
`1. A control system for a railway vital application system,
`comprising:
`a first controller having an external bilateral communications
`interface capable of sending and receiving a vital systems
`message within a railway vital application system, the
`message including a security code and vital data;
`a second controller having an external communications
`interface capable of receiving a vital systems message, but
`incapable of sending a vital systems message that is
`generated within the second controller, the second
`controller having a security code generator; and
`
`
`
`5
`
`
`
`IPR2017-00584
`Patent 8,714,494 B2
`an inter-controller communications pathway coupling the
`first and second controllers;
`wherein the first and second controllers respectively receive
`an input vital systems message including input vital
`systems data and an input security code, verify the input
`message integrity and generate output vital systems data,
`the second controller generates an output security code
`and sends it to the first controller, and the first controller
`sends an output vital systems message including the output
`vital systems data and the second controller output
`security code for use within the railway vital application
`system.
`
`E. Asserted Ground of Unpatentability
`Petitioner challenges the patentability of claims 1, 2, 5, 10, 11, 14, 17,
`
`and 18 under 35 U.S.C. § 103 over Essame1, El Fassi2, Beutler ’8633, and
`Beutler ’1464. The Petition also relies on the Declaration of Samuel Phillip
`Pullen Ph.D. (Ex. 1002).
`
`II. ANALYSIS
`A. Claim Construction
`Claims of an unexpired patent that will not expire before issuance of a
`
`final written decision are interpreted using the broadest reasonable
`interpretation in light of the specification. See 37 C.F.R. § 42.100(b);
`Cuozzo Speed Techs., LLC v. Lee, 136 S. Ct. 2131, 2144–46 (2016).
`Petitioner and Patent Owner submit proposed constructions for “railway
`
`
`1 Ex. 1008, US 7,721,149 B2, issued May 18, 2010.
`2 Ex. 1009, EP 1 089 175 A1, published Apr. 4, 2001.
`3 Ex. 1010, US 7,809,863 B2, issued Oct. 5, 2010.
`4 Ex. 1007, US 6,003,146, issued Dec. 14, 1999.
`6
`
`
`
`
`
`IPR2017-00584
`Patent 8,714,494 B2
`vital applications systems” or “vital systems,” and “incapable of sending.”
`See Pet. 18–21; Prelim Resp. 18–25.
`
`As demonstrated in the analysis below, we need not construe
`explicitly the broadest reasonable interpretation of “railway vital application
`systems,” “vital systems,” and “incapable of sending.” For purposes of this
`decision, we need not construe explicitly any other claim terms or phrases.
`See Vivid Techs., Inc. v. Am. Sci. & Eng’g, Inc., 200 F.3d 795, 803 (Fed. Cir.
`1999) (“[O]nly those terms need be construed that are in controversy and
`only to the extent necessary to resolve the controversy.”).
`B. Asserted Unpatentability of Claims 1, 2, 5, 10, 11, 14, 17, and 18
`1. Essame (Ex. 1008)
`Essame teaches a secure redundant system using two intrinsically safe
`computers equipped with secure digital outputs that implement a method for
`managing synchronous redundancy. Ex. 1008, Abstract, 1:66–2:2. As
`background, Essame discloses,
`secured verification/command
`to
`Applications
`relating
`processing are commonly used in automated transport, such as
`automatic urban trains. These applications use intrinsically safe
`computers that are capable of guaranteeing secure operation and
`detecting operating errors in the processing effected. An
`example computer is described in EP-A-1 089 175 [(El Fassi)].
`The computer implements a technique that includes detecting
`errors by means of a data encoding system and, if necessary,
`ensuring commands are in a safe position for passengers, which
`may include stopping the train.
`Id. at 1:14–23.
`
`
`
`7
`
`
`
`IPR2017-00584
`Patent 8,714,494 B2
`Figure 1 of Essame is reproduced below:
`
`
`Figure 1 depicts a processing system included in a railway vehicle.
`Ex. 1008, 3:35–36, 46–49. First and second intrinsically safe computers 10,
`20 each have a processor, a memory, a means of securization, and a plurality
`of local inputs, remote inputs, remote outputs, secure outputs,
`synchronization inputs/outputs, duplex inputs/outputs and command inputs.
`See id. at 3:53–62. Remote inputs are messages sent by a system providing
`information to the on-board computer. See id. at 3:64–67, 4:57–59. Remote
`outputs make it possible to send messages to a traffic management unit. See
`id. at 4:14–17, 60–61, 7:47–49. Local inputs are linked to sensors and
`sampled cyclically to determine the physical state of the vehicle. See id. at
`3:67–4:2, 4:56–57. Secure outputs are linked to elements that act directly on
`the vehicle and can adopt two states: a restrictive state that involves a safety
`response and a permissive state. See id. at 4:3–1, 61–62. Duplex
`synchronization links and communications inputs/outputs ensure
`synchronization of computers 10, 20 and enable data exchange. See id. at
`4:63–67.
`
`Each computer has the same programs used to effect the same
`calculations, which are executed cyclically to regularly calculate output
`8
`
`
`
`
`
`IPR2017-00584
`Patent 8,714,494 B2
`states based on input states. See id. at 4:25–28, 32–35. Command circuit 30
`operates in parallel with computers 10, 20 and receives data on the operation
`of the computers provided by the securization means indicating whether the
`computer has a fault or is operating normally. See id. at 5:1–6. Command
`30 circuit determines which computer is the master and which is the slave
`and can change the master if necessary in the event of a computer failure.
`See id. at 5:6–8, 11–18, 6:38–7:45, Fig. 3. The secure outputs are linked to
`addition circuit 40. See id. at 5:19, 7:19–25.
`2. El Fassi (Ex. 1009)
`El Fassi teaches secure data systems designed to have a level of
`
`security that is quantifiable and applicable to processes for automatically
`running rail track systems. Ex. 1008, 13, Abstract (57); 13 ¶ 1.
`Figure 1 of El Fassi is depicted below:
`
`
`Figure 1 depicts a plurality of host computers 10a, 10b, 10c, 10d
`
`interconnected by transmission medium 14, and each host computer having
`its own security peripheral 12a, 12b, 12c, 12d equipped to perform secure
`input output (I/O). See id. at 18 ¶ 35. At least one computer with a
`processor operates on input data items, each suitable for being associated
`
`
`
`9
`
`
`
`IPR2017-00584
`Patent 8,714,494 B2
`with a code so as to provide input data codes, and supplies output data items
`suitable for being associated with a code. See id. at 21, claim 1. At least one
`peripheral receives at least the input data codes, operands, and the nature of
`the operation for each elementary operation performed by computer
`processor. See id. The peripheral computes a code for each elementary
`operation performed by the computer processor. See id. The peripheral
`verifies proper operation of all or part of the computer processor program by
`detecting any errors produced in operation of the computer processor based
`at least in part on the input data codes and the code computed by the
`peripheral for each elementary operation. See id.
`3. Beutler ’863 (Ex. 1010)
`Beutler ’863 discloses a system for checking the accuracy of critical
`
`command data generated in a processor. See Ex. 1010, 1:14–17, 56–57.
`Figure 2 of Beutler ’863 is reproduced below:
`
`
`
`
`
`10
`
`
`
`IPR2017-00584
`Patent 8,714,494 B2
`Figure 2 depicts a command monitoring processing system. See Ex.
`1010, 2:9–11. Command generating and monitoring processing system 200
`includes command processor 202, monitoring processor 204, Input/Output
`(I/O) controller 22 coupled to consuming device 112 via data bus network
`228 and data bus interface 226. See id. at 3:38–45. Command processor
`202 generates commands 207 to be used by consuming device 112 from
`input 203. See id. at 3:46–49. Monitoring processor 204 receives command
`data 207 from command processor and uses the same inputs 203 received by
`command processor 202 to generate independently commands based on
`input data 203. See id. at 3:52–60. Monitoring processor 204 compares
`command data 207 received from command processor to internally
`generated commands and generates authentication key 209. See id. at 3:60–
`63. Authentication key 209 can comprise cyclic redundancy checks (CRCs)
`and the like. See id. at 3:1–3, 4:21–27. I/O controller 222 combines
`command data 207 and authentication data 209 into message packets 224
`and sends message packets 224 addressed to a specific consuming device
`112 to data bus interface 226 and data bus network 228. See id. at 4:4–12.
`After receiving message packets 224, consuming device 112 can determine
`if authentication key 209 within message packet 224 indicates command
`data 207 was verified as correct by monitoring processor 204. See id. at
`4:14–19.
`
`4. Beutler ’146 (Ex. 1007)
`Beutler ’146 disclose a method for providing error detection of
`periodic aircraft data transmitted between a sending unit and a receiving
`unit. See Ex. 1007, Abstract.
`
`
`
`11
`
`
`
`IPR2017-00584
`Patent 8,714,494 B2
`Figure 3 of Beutler ’146 is reproduced below:
`
`
`
`Figure 3 depicts the architecture for the method, including
`transmitting unit 2, data bus 10, and receiving unit 12. See id. at 2:29, 51–
`54. At transmitting unit 2, a data message made of a plurality of data words
`is sent to means 4 for determining the cyclic redundancy check (CRC). See
`id. at 2:36–41. Once the CRC is determined for the message, the CRC is
`sent to a formatting and transmitting means 6 that adds the CRC to the data
`message. See id. at 2:41–43. A packet of data comprising the data message,
`the CRC, and a keyword designating the end of the message leaves
`transmitting unit 2, enters the data stream in data bus 10 and passes to
`receiving unit 12. See id. at 2:43–53. Data packet enters input buffer 14 in
`receiving unit 12, and is sent to packet buffer 18. See id. at 2:55–67. A
`selected data message is sent from packet buffer 18 to an assembling and
`comparing means 20 to assemble the message, compute the CRC from the
`received message, and compare it to the CRC attached to the received
`message. See id. at 3:15–20.
`
`
`
`
`
`12
`
`
`
`IPR2017-00584
`Patent 8,714,494 B2
`5. Claims 1, 2, 5, 10, 11, 14, 17, and 18
`We have reviewed the Petition and the Preliminary Response, and
`determine that Petitioner does not show a reasonable likelihood of prevailing
`in establishing the unpatentability of any of claims 1, 2, 5, 10, 11, 14, 17,
`and 18 as obvious over Essame, El Fassi, Beutler ’146 and Beutler ’863.
`The question of obviousness is resolved based on underlying factual
`determinations including: (1) the scope and content of the prior art,
`(2) any differences between the claimed subject matter and the prior art,
`(3) the level of skill in the art, and (4) where in evidence, so-called
`secondary considerations. Graham v. John Deere Co., 383 U.S. 1, 17–18
`(1966). Against this background, the obviousness of the claimed subject
`matter is determined. Id. “[R]ejections on obviousness grounds cannot be
`sustained by mere conclusory statements; instead, there must be some
`articulated reasoning with some rational underpinning to support the legal
`conclusion of obviousness.” KSR Int’l Co. v. Teleflex Inc., 550 U.S. 398,
`418 (2007) (quoting In re Khan, 441 F.3d 977, 998 (Fed. Cir. 2006)).
`The Petition does not articulate, with reasonable clarity: (1) the
`
`particular teaching(s) of the four prior art references that are relied upon to
`meet the elements recited in independent claims 1, 10, and 17, (2) the
`differences between the claimed subject matter and the teachings of the prior
`art, and (3) the manner in which the particular teachings of the four prior
`references are to be combined to account for such differences and meet the
`elements recited in independent claims 1, 10 and 17. The portions of the
`Petition addressing “the first and second controllers respectively receive an
`input vital systems message including input vital systems data and an input
`
`
`
`13
`
`
`
`IPR2017-00584
`Patent 8,714,494 B2
`security code, verify the input message integrity and . . . ,” recited in claim 1
`and addressed below, are illustrative.
`Petitioner asserts initially that each of Essame, Beutler ’146, and
`
`Beutler ’863 teach a first and second controller. See Pet. at 42–44 (citing
`Ex. 1008, 3:53–55; Ex. 1007, Fig. 3, 2:42–44; Ex. 1010, 3:39–42; Ex. 1002
`¶¶ 146, 149, 150). In addressing the recitation “the first and second
`controllers respectively receive an input vital systems message including
`input vital systems data and an input security code,” Petitioner relies on the
`teachings of Essame, combined with El Fassi and Beutler ’146. See Pet 48–
`50 (citing Ex. 1008, 1:14–16, 19–24; Ex. 1009, 13, Abstract, 14 ¶ 9, claim 1;
`Ex. 1007, 1:20–23, 2:34–3539, 56–57, Fig. 3; 1002 ¶¶ 164–169). Petitioner
`concludes that a person of ordinary skill in the art “would have been
`motivated to adapt the processing system of Essame in accordance with
`the . . . teachings of El Fassi and Beutler ‘146 to receive vital systems
`messages that include vital data and a security code.” Pet. 50 (citing Ex.
`1002 ¶¶ 164–171); Ex. 1002 ¶ 171 (Petitioner’s expert stating same). To
`address “the first and second controllers respectively . . . verify the input
`message integrity,” Petitioner relies on various teachings of Essame, El
`Fassi, Beutler ’863, and Beutler ’146 (see id. at 50–52 (citing Ex. 1008,
`1:14–24; Ex. 1009 ¶ 25, claim 1; Ex. 1010, 4:22–26; Ex. 1007, 1:26–30,
`3:16–20; 1002 ¶¶ 174–177)), and concludes that a person of ordinary skill in
`the art “reading Essame in view of El Fassi, Beutler ‘863, and Beutler ‘146
`in combination would have understood how to apply the known techniques
`described in each, would have configured two controllers in an asymmetric
`way, and both controllers would verify the input message using a security
`
`
`
`14
`
`
`
`IPR2017-00584
`Patent 8,714,494 B2
`code.” Pet. 52 (citing Ex. 1002 ¶¶ 173–178); Ex. 1002 ¶ 178 (Petitioner’s
`expert stating same)).
`
`Based on the arguments and cited evidence, the Petition does not
`address sufficiently the proposed modifications to the prior art teachings that
`one with ordinary skill in the art would have made “to adapt the processing
`system of Essame in accordance with the . . . teachings of El Fassi and
`Beutler ‘146,” and “to apply the known techniques described in each” of
`Essame, El Fassi, Beutler ’863, and Beutler ’146. See Pet. 48–52; see also
`Prelim. Resp. 27–31 (discussing the multitude of necessary modifications to
`the prior art teachings based on Petitioner’s combinations).
`
`Even if we could discern the particular teachings or techniques of
`Essame, El Fassi, Beutler ’863, and Beutler ’146 that are relied upon and the
`manner in which the particular teachings or techniques are to be combined,
`Petitioner does not provide sufficient articulated reasoning with rational
`underpinning for combining the teachings of the prior art. For example,
`Petitioner’s stated reasons “to receive vital systems messages that include
`vital data and a security code,” (Pet. 50 (citing Ex. 1002 ¶¶ 164–171)) and
`“would have configured two controllers in an asymmetric way and both
`controllers would verify the input message using a security code” (see Pet.
`52 (citing Ex. 1002 ¶¶ 173–178) are conclusory and appear to be objectives
`derived from the language of the challenged claims. In the absence of
`sufficient articulated reasoning with rational underpinning, we are left to
`speculate as to why one with ordinary skill in the art at the time of the
`invention would modify Essame’s controllers 10, 20 in view of the various
`teachings of El Fassi, Beutler ’863, and Beutler ’146.
`
`
`
`15
`
`
`
`IPR2017-00584
`Patent 8,714,494 B2
`
`Accordingly, based on the record before us there is not a reasonable
`likelihood that Petitioner would prevail in showing that independent claim 1,
`and claims 2 and 5, dependent therefrom, are unpatentable over Essame, El
`Fassi, Beutler ’863, and Beutler ’146.
`
`Similar to claim 1, independent claim 10 recites “the first and second
`controllers respectively receive an input vital systems message including
`input vital systems data and an input security code, verify the input message
`integrity and . . . .” Independent claim 17, similar to independent claims 1
`and 10, recites, “receiving with respective first and second controllers a vital
`systems input message . . . that includes a security code and vital data, and
`independently verifying the input message integrity.” Petitioner’s analysis
`addressing the similar recitations of claims 10 and 17 is nearly identical to
`the analysis-addressing claim 1. Compare Pet. 59–62, 64–66 with, Pet. 42–
`44, 48–52. Accordingly, for the same reasons as those addressing claims 1,
`2, and 5, based on the record before us there is not a reasonable likelihood
`that Petitioner would prevail in showing that independent claims 10 and 17,
`and claims 11, 14, and 18 dependent therefrom are unpatentable over
`Essame, El Fassi, Beutler ’863, and Beutler ’146.
`
`III. CONCLUSION
`For the foregoing reasons, based on this record there is not a
`reasonable likelihood that Petitioner would prevail in showing that claims 1,
`2, 5, 10, 11, 14, 17, and 18 of the ’494 Patent are unpatentable.
`
`IV. ORDER
`Accordingly, it is ORDERED that inter partes review of U.S. Patent
`
`No. 8,714,494 is not instituted based on this Petition.
`
`
`
`
`
`16
`
`
`
`IPR2017-00584
`Patent 8,714,494 B2
`PETITIONER:
`Jason A. Engel
`Alan L. Barry
`Roberto Capriotti
`Benjamin E. Weed
`Katherine L. Hoffee
`K&L GATES LLP
`
`Jason.Engel.PTAB@klgates.com
`alan.barry@klgates.com
`roberto.capriotti@klgates.com
`benjamin.weed.PTAB@klgates.com
`katy.hoffee.PTAB@klgates.com
`
`
`PATENT OWNER:
`Jeffrey D. Sanok
`Mark M. Supko
`Vincent J. Galluzzo
`CROWELL & MORING LLP
`jsanok@crowell.com
`msupko@crowell.com
`vgalluzzo@crowell.com
`
`
`
`
`17
`
`